Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Rocky Brotli can write beyond memory

published 6 days ago

Summary

The Brotli compression library used by Rocky can accidentally write data outside its allotted space, which could cause the application to crash or be manipulated by an attacker. This affects any system that uses the Rocky Brotli package. Apply the latest Rocky Brotli update as soon as possible to protect your systems.

What to do

Update rocky brotli to version 0:1.1.0-8.el10_2.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Rocky Linux:10	rocky	brotli	< 0:1.1.0-8.el10_2.1 Fix: upgrade to 0:1.1.0-8.el10_2.1

Original advisory text

Important: brotli security update

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.

Security Fix(es):

* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

https://errata.rockylinux.org/RLSA-2026:90449 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2558973 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:90449 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

8.1 High

Timeline

Published29 Oct 2026

Updated29 Oct 2026

First seen29 Oct 2026

Sources

RLSA-2026:90449 · OSV

Track software like this

Free during beta